On-device parsing
The bank registry, the parser families and the merchant dictionary ship inside the app. No SMS is transmitted to be parsed; there is no endpoint that could receive one.
Security & privacy
A finance app that reads SMS has one promise to keep first.
This page is the promise, in detail: what the app reads, what leaves your phone, what never does, and how that is enforced in the code rather than only in a policy. The legal version is the Privacy Policy.
- 0SMS message bodies stored on any server
- 1sensitive permission requested: Read SMS
- 1 tapto delete everything, server and phone
The data path
What happens to a bank alert.
A message is read on the phone, parsed on the phone, and reduced to the handful of fields a transaction needs. Only those fields travel.
What is stored in your account
Everything here is yours, visible in the app, exportable, and deleted with the account.
- Phone number
- To sign you in with a one-time code. It is your account identifier.
- Name, photo, income, budget, savings goal
- What you enter in onboarding and Profile. Income and budget drive “safe to spend” and goal affordability.
- Accounts and cards
- Bank name, type, last four digits, current balance, and the order you keep them in.
- Transactions
- Amount, direction, date, merchant, category, the account it hit, any note you add, and links to a goal or asset.
- Bills, goals, assets, liabilities
- What you track, with their amounts, dates and payment history.
- SMS fingerprint
- A SHA-256 digest of each imported alert, used only to recognise one already seen. It cannot be reversed into the message.
What is never stored — anywhere
Not on our servers, not in the app’s database, not in a log.
- The text of any SMS
- The database has no column for it. Parsing happens on the phone; the message is discarded once read.
- OTPs, personal messages, anything not from a bank
- The parser skips them. Nothing about them is stored, on the phone or off it.
- Your bank login or net-banking credentials
- We never ask. There is no Account Aggregator consent, no screen-scraping, no bank API.
- Your contacts, location, photos or files
- The app does not request those permissions. The one photo it can read is the profile picture you choose.
- Balances quoted in SMS
- Used on the phone to anchor an account balance; the quoted figure itself is not stored as a message.
- Advertising identifiers or analytics profiles
- There is no ad SDK and no third-party analytics in the app.
Permissions
What the app asks Android for, and why.
The release build declares exactly these. Camera, microphone, storage, contacts and location are not requested and not declared.
Read SMSRequired for automatic capture. Requested only after an in-app explanation, and only after you tap Continue. Deny it and the app works with manual entry.
NotificationsBill reminders, goal and card alerts. Asked once, after you have seen your first numbers, never on first launch.
BiometricsTo lock the app behind your fingerprint or face when you return. Optional, off by default.
PhotosOnly when you choose a profile picture, through Android’s photo picker — the app never sees your library.
Run at boot / backgroundSo the 15-minute background sync resumes after a restart. Standard Android background-work permissions; no foreground service, no location.
Controls
Enforced in the architecture, not the fine print.
Digest-only server
Migration 019 removed message bodies from the server schema and replaced them with SHA-256 digests. Dedup semantics are identical; disclosure risk from a breach is zero for message content.
Encrypted at rest on the phone
The local database is SQLCipher-encrypted; the key lives in the Android Keystore. Notes are additionally encrypted with AES-256-GCM. Android’s cloud backup of app data is disabled.
Row-level security
Every server table is protected by Postgres row-level security keyed to the signed-in user. Balance arithmetic runs in server-side functions with a single writer, so a client cannot fabricate a balance.
App lock and no screenshots
Biometric lock on return to the app, and FLAG_SECURE on every financial screen so nothing reaches the screenshot pipeline or the recents thumbnail.
TLS everywhere
All traffic is HTTPS. Cleartext traffic is disabled at the platform level.
Anonymous, opt-in parser reports
When a bank format is not recognised, you can send its shape — every digit zeroed, amounts and names replaced with placeholders — from the SMS Diagnostics screen. Nothing is sent unless you tap Send; nothing sent is linked to you.
One-tap deletion
Delete Account runs a single server function that removes your profile and cascades to every table, deletes uploaded files, then deletes the login itself and wipes the phone. There is no soft delete.
Deleting your data
Profile → Delete Account. Server first, then the phone, in one operation. There is no retention window and no “we may keep a copy”. If you cannot open the app, the account deletion page explains how to request it.
Reporting a vulnerability
Found something? Write to security@wealthmonk.co.in with steps to reproduce. We acknowledge reports within three working days and do not pursue researchers who act in good faith and keep user data private.
Read it, then decide.
The Privacy Policy says all of this in the language a regulator expects. The app says it again, in plain words, before it asks for anything.
Coming soon on Google Play How your data is handled
